Privacy notice
This site doesn’t track you. The only data I get is what you send me. Here’s what happens to it.
The short version
- No cookies, no analytics, no tracking pixels, no ads. Nothing loads from another company’s servers.
- My host, Vercel, logs basic request data (like your IP address) under its own terms, not under a contract with me. The logs I can see disappear after about an hour.
- If you email me or book a call, I use your details to reply and to work with you. Nothing else.
- I don’t sell your data, share it for advertising, or add you to a mailing list.
- You can ask me to show, correct, or delete your data at any time: email alex@alextacho.com.
Who I am
I’m Alexander Tacho (Alex Tacho), based in North Carolina, USA. I’m responsible for the personal data described here, which makes me the “controller” in GDPR terms. You can reach me at alex@alextacho.com.
I work alone, so there’s no data protection officer. I haven’t appointed a representative in the EU or UK.
When you visit this site
Vercel Inc. (USA) hosts the site. Like every web server, it records each request: your IP address, browser type (user agent), the page you asked for, the page you came from (referrer), and the time. Vercel handles these logs under its own terms and Vercel’s privacy policy, to deliver the pages and protect the site against abuse.
- Legal basis: my legitimate interest in running a working, secure website (GDPR Art. 6(1)(f)).
- How long: the logs I can see are kept for about an hour. How long Vercel itself keeps them is set by its privacy policy.
I don’t run analytics, and I don’t build profiles of visitors. I don’t look at the logs, and I couldn’t build a profile from them if I wanted to.
Cookies and similar tech
This site sets no cookies, uses no local or session storage, and loads no fonts, scripts, or images from third parties. That’s why there’s no cookie banner: there’s nothing to consent to.
When you email me
I get your email address, your name, your message, and anything else you choose to include. I use it to reply, to set up and deliver work we agree on, and to manage the waitlists for my fractional and ProductOS offers.
- Legal basis: taking steps you asked for before a contract, or the contract itself (Art. 6(1)(b)). For anything else, such as a general question, my legitimate interest in answering people who write to me (Art. 6(1)(f)).
- Who handles it: my email runs on Google Workspace, and Google processes it for me.
- How long: emails stay in my inbox while they’re relevant to our conversation or working relationship, or for as long as tax and legal record-keeping requires. Ask me to delete them sooner and I will, unless the law makes me keep them.
I won’t send you marketing email unless you’ve asked for it. Joining a waitlist means I’ll email you when a spot opens, not that you’re subscribed to anything.
When you book a call
The “Book a call” link takes you to Calendly, which is a separate site. Calendly, Inc. (USA) processes your booking details (name, email, your answers to the booking questions, time zone) for me, under its data processing agreement. Calendly sets its own cookies on its pages, under Calendly’s privacy policy.
Your booking goes into my Google Calendar (Google Workspace). Calls happen on Google Meet or Zoom; see Google’s privacy policy and Zoom’s privacy statement.
- Legal basis: steps you asked for before a contract (Art. 6(1)(b)).
- How long: the same criteria as email above.
The LinkedIn link
It’s a plain link. This site shares nothing with LinkedIn. Once you’re on LinkedIn, LinkedIn is responsible for your data under LinkedIn’s privacy policy.
Who else sees your data
Only the companies named above: Vercel (hosting), Google (email, calendar, Meet), Calendly (booking), and Zoom (calls). And authorities, if the law requires me to hand something over. I don’t sell your personal data or share it for targeted advertising, including as “sale” and “sharing” are defined in US state privacy laws.
Data leaves the EU and UK
I’m in the USA, and so are the companies above, so your data is processed in the USA. The US doesn’t have a general adequacy decision that covers me. For email and bookings, Google’s and Calendly’s data processing terms rely on the EU–US Data Privacy Framework and, as a fallback, the EU Standard Contractual Clauses and the UK Addendum. Ask me and I’ll send you a copy of those clauses, or read them yourself in Calendly’s data processing addendum and Google’s data processing terms. Vercel handles hosting data in the USA under its own terms, without those clauses.
Your rights
If you’re in the EU or UK, you can ask me to:
- give you a copy of the data I hold about you (access), including in a portable format (portability);
- correct it (rectification);
- delete it (erasure);
- stop using it for a while (restriction);
- stop using it where I rely on legitimate interests (objection).
Email alex@alextacho.com and I’ll reply within one month. You can also complain to your local data protection authority. In the UK, that’s the Information Commissioner’s Office (ico.org.uk). In the EU, the European Data Protection Board lists every national authority.
Giving me your data is voluntary. The one catch: I can’t reply to you without an email address. I don’t make automated decisions about anyone.
If you’re in the US
State privacy laws like the CCPA don’t apply to a business my size. I’ll honor the same requests anyway: email me to see or delete your data.
Do Not Track and Global Privacy Control: this site doesn’t track anyone, so those signals have nothing to switch off. Everyone gets the no-tracking version.
Children
This site is for businesses, not for anyone under 16. I don’t knowingly collect data from children. If you think a child has sent me personal data, tell me and I’ll delete it.
Changes to this notice
If anything here changes, I’ll update this page and the effective date at the top. This version is effective .